Articles & Snippets

1. Check PHP-FPM Max Children

PHP-FPM limits the number of PHP processes using max_children. Too low can block requests, too high can overload the server.

grep max_children /opt/cpanel/ea-php81/root/usr/var/log/php-fpm/error.log

This searches the PHP-FPM error log for max_children settings. Adjust as needed based on traffic.

2. Check Apache MaxRequestWorkers

Apache's MaxRequestWorkers limits simultaneous requests. If too low, visitors may get 503 errors.

grep MaxRequestWorkers /etc/apache2/logs/error_log

This pulls the MaxRequestWorkers setting from Apache logs. Increase it if your server handles many connections.

3. Detect Possible DOS Attacks

You can identify repeated connections to ports 80 and 443 that may indicate a DOS attack.

netstat -an | egrep ":80|:443" | egrep '^tcp' | grep -v LISTEN | awk '{print $5}' | egrep '([0-9]{1,3}\.){3}[0-9]{1,3}' | sed 's/^\(.*:\)\?\(\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}\).*$/\2/' | sort | uniq -c | sort -nr | sed 's/::ffff://' | head

This counts active connections per IP to your web ports and shows the top IPs. Frequent repeated connections may indicate malicious activity.

Useful Documentation

• PHP-FPM Max Children Tuning
• Apache MaxRequestWorkers Tuning
• Detecting Apache DOS Attacks

Summary

Check PHP-FPM max_children to control PHP processes. Monitor Apache MaxRequestWorkers to handle concurrent requests. Use netstat to detect unusual traffic that may indicate DOS attacks. Refer to cPanel documentation for proper tuning guidelines.

---

Designer Edmonton